Functions that join records from subqueries.
Returns a record from a subquery (the lookup table) producing a match between a field in the source table (sourceField) and a field in the lookup table (lookupField).
In contrast to the lookup command, the lookup function nests all included fields in the form of a DQL record.
In a case, where more than one match is produced in the lookup table, only the first matching record of the lookup table is returned. When the key values in the source and lookup table are both null, corresponding records aren't matched.
lookup(lookupTable, lookupField [, sourceField] [, executionOrder])
| Parameter | Type | Description | Required |
|---|---|---|---|
lookupTable | execution block | Subquery producing the lookup table. | Required |
sourceField | expression | The matching field in the source table (left side). | Optional |
lookupField | expression | The matching field in the lookup table (right side). | Required |
executionOrder | Defines which side of the join will be executed first. The allowed values are | Optional |
The data type of the returned value is record.
data record(location = "Vienna", bookings = 1337),record(location = "London", bookings = 2431)| fieldsAdd result = lookup([data record(city = "Vienna", country = "Austria"),record(city = "Barcelona", country = "Spain")],sourceField:location,lookupField:city)
Query result:
| location | bookings | result |
|---|---|---|
|
| city: |
|
| null |
In a case, where more than one match is produced in the lookup table, only the first matching record of the lookup table is returned.
data record(location = "Barcelona"),record(location = "London")| fieldsAdd result = lookup([data record(team = "FC Barcelona", city = "Barcelona"),record(team = "Chelsea", city = "London"),record(team = "FC Arsenal", city = "London"),record(team = "Tottenham Hotspur", city = "London")],sourceField:location,lookupField:city)
Query result:
| location | result |
|---|---|
| team: |
| team: |
The same limits as described for the join command apply.
Preview
Returns the Smartscape node name.
getNodeName(expression)
| Parameter | Type | Description | Required |
|---|---|---|---|
expression | string | The expression to determine the Smartscape node ID. | Required |
The data type of the returned value is string.
fetch bizevents| fieldsAdd getNodeName(dt.smartscape.host)
Preview
Returns the field value for a Smartscape node.
getNodeField(expression, name)
| Parameter | Type | Description | Required |
|---|---|---|---|
expression | string | The expression to determine the Smartscape node ID. | Required |
name | string | The Smartscape field name to be queried. | Required |
The data type of the returned value can be boolean, long, double, timestamp, timeframe, duration, string, ip, uid, binary, array, or record.
timeseries avg(dt.host.cpu.idle), by:{ dt.smartscape.host }| fieldsAdd getNodeField(dt.smartscape.host, "tags")